Ask MetaFilter questions tagged with web and software

Any good books on web penetration testing?

jacobian — Sun, 18 Oct 2009 08:28:13 -0800

Any good books on web penetration testing? I'm a web developer and consultant, and I often deal with web application security. Everything I know about penetration testing I've learned in a pretty ad hoc manner, and I think it's time to give myself a bit of a more formal background.

I'm familier enough with the concepts (SQL injection, XSS, CSRF, etc.); I even teach classes on those subjects. I've got decent knowledge crypto and digital security in general. I also have a few tools I sorta know how to use (Burp Suite being the main one). But I don't really have any good grasp on the "right" way to actually conduct a formal web penetration test -- I usually just flail around for a while trying different things until I "feel" satisfied. Doesn't really make for a very scientific process, I know.

So: any suggestions for books (or any other sort of learning material) on web penetration testing? I'd prefer something more on the advanced side of the spectrum; I'd rather be overwhelmed than bored.

Need money now thankyou.

drjimmy11 — Fri, 09 Oct 2009 15:50:15 -0800

What are some good tech-centric temp agencies in L.A.? Hi! Yet another in my long series of job-trauma questions.

I'm currently between jobs- I'm a web/software developer, specializing in flex/AS3 but with years and years of doing html/js/ajax/php type stuff too. I have a pretty strong resume, I like to think, going back about 10 years.

I'm currently getting contacted by a lot of recruiters and going on a lot of interviews, but it's a very drawn-out process. Basically I need a gig to bring in some money now- cutting up PSDs or whatever is fine, I'm not proud at this point. I'm curious if anyone knows any decently reputable agencies who could get me something like this soon. Specific names of agencies are appreciated, referrals to specific people are even more appreciated. (meMail me if you like).

(I'd also be interested in where I can advertise myself as a flex freelancer, but I'm more inclined towards W2 right now for a few reasons.)

Thanks!

Pros & Cons of bringing web development in-house?

MeatLightning — Fri, 09 Oct 2009 11:33:22 -0800

Pros & Cons of bringing web development in-house? Hi all -
I manage a mid-size e-commerce website. We currently work with an agency to build and maintain our site. We are considering hiring a dev (C# / .NET, SQL) and taking over development... or at least much of it (still may go out of house for UX, front-end dev).

Anyone have any advice, experiences, warnings, etc they can share?

Have you gone down this road? How did it go? What should we watch out for?

thanks in advance!

"Proactive? Paradigm? Aren't those just words dumb people use to sound smart?"

drjimmy11 — Fri, 11 Sep 2009 08:49:10 -0800

Where does one proactively look for software (specifically Flex) jobs these days? So I'm on the market. I have about ten years web/software development experience overall, with the last 3 focused in Flex. I'm in Los Angeles and not keen to move.

In the past I would just put my resume up on Dice and get bombarded by recruiters. This time though, the response has been a little more sparse, and I'd like to find something sooner than later.

So:

Are the major search sites (Monster, Careerbuilder) as useless as I remember them for tech jobs?

Is there anywhere tech-specific besides Dice I should post my resume, or search for jobs? This would include job sites or message boards or whatever.

Are there any other strategies I'm missing, or should I just browse the websites of specific employers who i think I might like?

Thanks!

What software should I use to design a Webpage logo?

hellodonna — Wed, 26 Aug 2009 10:09:42 -0800

I am trying to create a professional looking logo for a Web site. I am using GIMP but finding I am very limited in terms of what I can do with it. Is there a software package that I should be using that will allow me to create a good looking logo/header image? I understand Photoshop is the best however, it's really expensive (700.00). Are there any software alternatives or do I just have to pony up for Photoshop? By the way, I have a PC.

Can you "Save For Web" in Lightroom?

chocolatepeanutbuttercup — Thu, 06 Aug 2009 15:53:12 -0800

Best web photo prep software? Will Lightroom work? Asking for a friend: She is using Adobe Lightroom on a Mac and is familiar with preparing photos for print. Now she needs to be able to prepare photos for a webblog (usually jpgs at medium compression and at no more than 500 pixels wide.)

I looked (quickly) at Lightroom and couldn't figure out how to first, resize an image and second, control the compression. Perhaps it's possible and I just couldn't find it?

If Lightroom is not the answer, I was hoping to find a standalone version of something like Photoshop's "Save For Web" feature where you can see how much compression you're adding and what the end result will be. She could export her photos from Lightroom, pull them into some standalone program to prep them for the web and save them from there. Bonus points for open-source.

Any ideas? Thanks.

Which forums do the best web programmers hang out at?

jackson5 — Fri, 26 Jun 2009 16:15:45 -0800

Which forums do the best web programmers hang out at? Long story short: I've got a web site that already does over 1 million pageviews per month. I've got a great idea to take it to the next level, but I'm looking for someone who can handle the coding and technical aspects in exchange for an equity stake.

I'm wanting to bring aboard a great programmer who doesn't necessarily need the work but will be motivated by the equity.

Which forums would you recommend I post on to find this person?

Also, if there's anyone interested here, let me know.

Coop TLD Registrars?

thebigdeadwaltz — Mon, 11 May 2009 06:12:09 -0800

I'd really like to get a Coop TLD, but I'm having a hard time finding an affordable and easy-to-use registrar. Any recomendations for companies that do a good job with this TLD? Any experiences? I'd really like to be paying sub-$20/year.

My application requests an XML file and I need to plan how to host that file so it's always available and zippy

Your Time Machine Sucks — Tue, 03 Mar 2009 05:17:36 -0800

Please give me some input on web hosting planning for a small XML file which might get a lot of requests. I'm working on an application which allows the user to load an XML file. The XML is less than 2K and will probably be loaded once per usage session, which could happen a few times a day. I can't speculate about how many users there will be, but the outcome that I need to (over)plan for is the one where there are metric fuckloads right out of the gate.

How would you host this file to make sure it is always reachable and zippy? Would you trust one single hosting company to host it? Which one/which plan? Which hosts would you avoid like the plague? Or would you put your eggs in multiple baskets and have a couple of hosts which the app can try in sequence to see if they are reachable? I'm willing to pay for bulletproof uptime and reliability, doesn't have to be a cheapass plan, but it might not be cost-effective to pay for a hosting plan oriented towards customers who need huge amounts of bandwidth or root access rather than the ability to handle lots of simultaneous low-bandwidth requests of one dinky file.

Thanks very much for your input!

Spend our money by suggesting software!

furtive — Wed, 25 Feb 2009 16:34:13 -0800

We're a web dev shop with $700 that needs to be spent on software by the end of fiscal. What should we get? We're a small team of three developers, all running OSX with Windows running on Parallels/VMWare for Outlook purposes. We're running Adobe CS3 with a mix of TextMate and BBEdit for the rest. Back end is .net stuff running on ms sql.

What we are looking for are tools that could make us more productive, communicate with each other better, track work or just have fun. $700 max, can't go over.

Robust Webex alternatives?

pallen123 — Mon, 22 Dec 2008 06:53:24 -0800

Best, price-competitive alternatives to Webex that include attendee scheduling and reminders? I'm looking for a solid, easy to use alternative to Webex, but I need some advanced features like a way to show attendees different scheduled times/dates for webinars; a way for them to signup, email reminders 2 days before the webinar and the day of the webinar; and then a way to send attendees a link to a survey after the webinar is over.

I know there are nice free services out there like Yugma, but I'm not aware of any that offer these kinds of additional features.

Any suggestions are greatly appreciated. Thank you!

Help me organize my time and projects by the hour.

metalheart — Sat, 29 Nov 2008 03:51:29 -0800

What time/project management software or sites might be able to help me view my week in hourly clumps and allow me to check off completed tasks or monitor their success? I've tried a number of GTD services, but none of them has been quite right, so I'm looking for suggestions. I've searched through Ask MeFi, but I've not really found anything like what I'm looking for, so here goes.

I really want to manage my time better. I already do pretty well on the whole, but I want to do better, so I can accomplish more. I already use Google Calendar for basic things, like house chores, but I've found it doesn't really cut it for me on other things--for whatever reason.

Pen and paper doesn't work for me, as I'm a very computer and mobile-oriented person. I've tried Todoist and liked its more textual system and idea of checking items off as you completed them, but it too fell short in the end. (It wasn't as intuitive as I'd have liked.) I tried Basecamp, but I hated the interface design and found it to be way too basic.

Currently, I'm trying out RescueTime for my computer time management, but I'd rather if it could do offline goal tracking and statistics as well...

It seems, overall, that I need a few features from each of these services, really, and I can't seem to find anything that fits that.

What I would like to find is some (preferably) web-based or desktop software that will work more on an hourly basis. What I mainly want to do is work a certain number of hours on various tasks, each week. I'm a student, and it's my summer holiday. I want to freelance several hours a week, work on art for a number of other hours, write, etc.

What time/project management software or sites might be able to help me view my week in hourly clumps and allow me to check off completed tasks or monitor their success?

P.S. - It'd be great if there were some sort of mobile alert thing for this as well, but it's not necessary. Would just be a nice to have.

How do we make web-based scheduling available to patients?

blueberry — Wed, 26 Nov 2008 22:31:48 -0800

Looking for a way to allow people to schedule their vet appointments via the web. My friend is setting up an animal acupressure business out of her home. While she is like Dr. Doolittle when it comes to animals, she's like John McCain when it comes to HTML.

We want to set up a pretty basic web site for her: main page, FAQs page, maybe a page with how-to-get-here directions... however,

here's the gist of the question:

She would like to have a page with a calendar so that people can see appointment availability and also make appointments via that same page (that is, say a client sees there's an opening from 2pm to 6pm on Tuesday, so they click on something and then are able to make an appointment from 2–3pm). The calendar could show a month or a week at a time, but would need to have a "next week/month" and "previous week/month" so people could schedule weeks/months in advance.

Once clients filled out the "schedule appointment" form
(which would ask for [day/time], name, phone number, email address)
and clicked submit, the schedule calendar would be updated so that that block of time would no longer be shown as available for other people to make appointments.

If it matters. there are only two durations of appointments that would be needed: 90 minutes for new clients, and 60 minutes for previous clients. It would be nice if she could somehow tell the scheduling software that after a 90-minute session, she'll need 30 minutes to take care of all of her notes (so she would be unavailable for other appointments), but maybe that's too intricate and she'll just have to book 2-hour slots and then tell the people that it'll actually only be 90 minutes in-office.

Finally, there are two forms that new clients need to fax in before their appointment (an intake form about their animals various info, and a form that just needs the signature of their veterinarian). I was thinking that it would be good to have an automatic confirmation email go out right after the person makes their appointment—the email would say hello, list their appointment date and time, and include a reminder about the need to fax in the two documents.

Is there some sort of web plug-in or something out there that can do this calendar-scheduling this for her?

Right now she has no web page, so if your suggestion requires something specific ("...Such-And-Such requires that your web host be running Apache v4.3 with the retro-encabulator and prefamulated ammulite..."), please let me know so we can choose the proper hosting place.

Also, she's on a Mac, so if you happen to know of any WYSIWYG web page builders out there that would allow her to easily set up something like this on her own, please throw those suggestions my way too.

So just to recap: web-based calendar/scheduling program that she can embed in a page and doesn't need to touch or fiddle with—just look at to see her schedule.

Thanks in advance!

Looking for a CMS/web-based software to manage regional event listings.

c:\awesome — Sat, 06 Sep 2008 13:13:07 -0800

Looking for a CMS/web-based software to manage regional event listings. I'd like to build a site that lists car shows happening around the U.S. Ideally, I'd like to find a Wordpress-esque piece of software that can manage this for me, and offer things like Google Maps integration. Does such a thing exist, or am I going to have to roll this on my own?

Looking for good web- or desktop-based RSS reader that can handle older posts

fsmontenegro — Fri, 05 Sep 2008 21:26:50 -0800

What options do I have for a good web- (preferred) or desktop(Windows)-based RSS reader that has good options for managing older posts within feeds? I've been using Google Reader as my primary reader for as long as I can remember, but I'm getting fed up with its behaviour around auto-archiving posts after 1 month and not being able to mark older posts as unread.

I subscribe to approximately 100 feeds, some that are chatty (dozens of posts a day) and some that are pretty quiet (1 post every 1-2 weeks or less).

Every now and then I find a new blog to follow and when I subscribe to it I'd like to easily read previous posts as well. Google Reader retrieves older posts, but doesn't let me mark them as unread.

Also, it has the very annoying feature of marking as read anything older than 1 month. This is fine for a chatty feed, but I don't like this behaviour for quieter feeds.

I looked into FeedDemon/NewsGator but it seems to also be limited in handling older posts.

Are there any options for a decent solution that is more flexible for older posts?

the Dr Frankenstein of collaborative software

brandnew — Wed, 27 Aug 2008 05:18:17 -0800

Easiest, most effective way to stand up a collaborative portal? I'm interested in standing up a collaborative portal for a new digital community. I want to take advantage of new advances in web software over the last 3-4 years.

I want to include as many of the following "features" as possible (in order of preference): membership profiles, social relationships, social bookmarking, search, content management, file storage and sharing, wiki, messaging, discussion boards, ratings & rankings, chat, sub-group creation, whiteboards, project management, time management, web-casts, surveys, polls, blogging, collaborative filtering, and Q&A.

Sure, I can implement these features from the bottom up myself - it would take awhile and be quite expensive. However, I really don't want to re-invent the wheel. I know most, if not all, of these features already exist in some form or another, either as either hosted services or separate web products.

So, a few questions:

1. First, is it even possible to mash up all of these various hosted services into something that looks like one cohesive site?

2. If yes to 1, are there patterns, best practices, examples, or support groups to help execute such a thing?

3. Otherwise, if I host it myself (to protect sensitive data), would it be easier to build it from scratch (assuming I'm an expert developer)? Or hack together a bunch of separate products?

Sync Blackberry memopad to the web?

aebaxter — Wed, 20 Aug 2008 16:22:09 -0800

How do I sync my notes in my Blackberry Curve's memopad to a web-based service? I use Google Sync to automatically sync calendar events created on my Blackberry to my Google Calendar. I use Remember the Milk to sync my RTM task list with the tasks app on my Blackberry. What I can't figure out is how I can create notes in the Blackberry memopad app and have them automatically sync with a web-based service.

I know apps like Evernote and Backpack will let you email in notes, but I'd like something that actually syncs the memopad to the web. Does this exist? I've Googled, but I've failed to find a solution.

How to stop torrents at work?

numlok — Mon, 11 Aug 2008 19:13:20 -0800

I'm sure this question will not make me the most popular student at the dance, but is there a way to identify (via IP) machines running BitTorrent clients within an internal network (ie. work)? My company has around 50 employees, and the old, "Please don't torrent at work" doesn't seem to be doing much good anymore. It brings our email and web browsing to a near standstill, and dropping by the "usual suspects" is not only tiresome, but doesn't seem to find all the sources of traffic any longer. Any help would be appreciated, thanks.

Should I Stay or Should I Go?

Anonymous — Tue, 01 Jul 2008 09:58:40 -0800

What's the best approach to take with the a lead software developer after being left holding the ball? About a month into a new full-time development gig (after almost a decade of contracting/freelance for me) the lead developer left for a two week vacation with assurances that we were more or less feature complete and the only thing left to do before launch would be cleaning up a few bugs.

Lies. (duh)

While on vacation we've found huge areas of functionality that were unimplemented, and others that were implemented so fragilely that they were bound to break. It's been a week of hell scrambling to get everything finished while at the same time not throwing lead-developer under the bus with the higher ups.

Lead developer has a huge amount of seniority. I'm the only other member of the team with any experience in the software industry (other developers have less than a year of professional experience). There's no formal project management at the company.

I'd like this job to work out. What approach do I take with the lead when he gets back? Do I point blank (in private) confront/talk-to him about the the lack of organization/management and what I view as a lackadaisical attitude towards developing code that actually works? Do I accept this is just his MO and work around it while covering my ass at the same time?

Any advice on ways to deal with this situation in a positive way would be appreciated. I'm used to being brought into situations like this as a contractor where I can drop in, hurt feelings, get something done, then move on to the next gig. I don't think that works in a situation you'd like to work out long term.

Configured, Boiled Down Numbers Please

rokusan — Wed, 14 May 2008 21:36:20 -0800

A good, modern, local website traffic stats solution? I used to know this stuff, but it's been many years and technology changes, yadda yadda, and this has some special odd requirements... so I prefer some hive mind opinions...

I have a colleague looking for a good solution to traffic stats reporting. He is responsible for dozens of websites, with new ones being added/removed every couple of weeks -- promotions and projects from various departments. He has access to combined/extended Apache logs (regular + referrer) already, but since he controls the websites, he is also open to a javascript-triggered thingie on each page, and a custom server that logs things itself. Either is fine as long as it churns out the results.

For results, he'd need an assortment of the usual hits/views/referrers stuff (visitors from Chile, most popular pages this week, hits on this certain link), but boiled down nicely like so:

1) takes raw logs and turns them into something human-readable.
2) scheduled (weekly or monthly) reports automatically saved as fixed files (auditable, this not recreated each time it's run).
3) reports showing just the info he wants* e-mailed to him as attachments (PDF, ideally, but text files would work) so he can present to management.
4) the ability to request custom reports (the period from Sept 1 to Sept 14, users from China only) on demand, presumably from some kind of web interface -- an on-the-fly config run one-off.
5) the ability to combine or separate data from diff sites/logs by configuration. (that is: these two sites are the same, but these four are all to be tracked separately)

* I don't have a list, but he says it will be one or two pages and NOT change over time. A template of certain reports?

He is considering hiring a human being part-time to do this with some offline program as a secretarial task every week... but that struck me as crazy since it's automatable, right? Right? Hm.

It can't be Google Analytics, sadly for me (I know how to use that) and for privacy/security reasons he'd prefer something running on his own Un*x server rather than a web service.... whether it's the same server as the websites or another doesn't matter, as long as he can control access and keep the data private.

In the old days, I would say this all called for urchin or awstats, I think... plus some magic I don't know about to turn the results into pretty reports and mail them from a big old cron job.

From my perspective (helping find/source/make/install this), I'd be fine with something very complicated that I can tweak the configuration of to produce just what he's asking for -- and no more.

Or if something does all the processing, will run reports on a schedule and produce some kind of manageable (parsable?) output like plain flat tables, I can probably manage turning that into pretty documents and mailing them out with additional scripty code that I can stumble through.

Open source and hackable preferred, because of the configurability and tweakiness required... or guidance to existing things that can be cobbled together. If someone has built/integrated one of these before, or something similar, please mefi-mail me and maybe it's easy work, too. I may have overcommitted myself in trying to help.

How can I create a social networking site?

lukeklein — Sat, 12 Apr 2008 15:39:51 -0800

How can I create a social networking site? I am in Southern California (Inland Empire/Orange County) and interested in building a social networking/message board/blog site along the lines of Sermo or Metafilter that isn't really about customizable media and meeting friends, as much as it is for people within a certain specialty, let's say the veterinary community, to share their ideas about their expertise with peers, receive newsletters relevant to their work, and ask for their peers' opinions or advice. I've come across several names like Elgg and Drupal, but I don't have the technical expertise to even recognize them as potential solutions to my problem!

Are their any open source programs and/or software firms that specialize in developing these types of platforms? Do I even need to go to a large firm, or is an individual software developer sufficient? How did the guy that created Facebook do what he did?

Just to be sufficiently clear, the features I am looking to enable on this site are:

Newsletters from the admin and notable writers of the industry
Anonymous polling of veterinarians' (members') opinions in current and relevant topics
blogs
Message boards
POSSIBLY a feature that allows individual vets to create friends lists of other vets they meet at conventions and locally, to facilitate their networking abilities.

If anyone here can direct me to someone that can work with me, I would be eternally grateful.

web forum software with subforums

zorro astor — Wed, 05 Mar 2008 19:39:17 -0800

Recommend a web forum software that allows for an arbitrarily large number of sub-forums. I want to build a tree structured forum: let's say on the front page you can select from Cars and Trucks. You click on Cars and it takes you to a list of makes. Then you click on makes and find a list of models. You click on that and it takes you to a list of years. You click on that and you are in the forum. I only want to true discussions at the bottom of the 'tree'

Website, what are you made of?

unexpected — Sat, 09 Feb 2008 09:59:31 -0800

[What's that website filter] What's the website that let's you plug in a URL, and then it tells you what software the site is using? (Ex: site is using Wordpress, Javascript, PHP, RoR, etc.)? Arg. I know this is going to get answered in 3 seconds, and I've seen it before, I just can't seem to find it. anywhere.

Web remote control

mphuie — Mon, 21 Jan 2008 13:51:43 -0800

Best web server/language for running remote tasks? I have some console scripts/executables that I'd like to be able to run on my home machine via a web site. What is the best method to do so?

I have tried using Apache/PHP and trying exec(), shell_exec(), system(), running perl scripts and exe's, but keep running into small quirks, ie. not grabbing script output, not running at all, hanging, etc.

I'd also like some interaction between the scripts and the web pages, ie. form variables as parameters.

Is there a recommended way to do this? This is on a windows system. I am using XAMPP but am open to using any software/language.

Making Complex Connection Webs

divabat — Thu, 13 Dec 2007 23:51:46 -0800

If I have the data "A is friends with B, B is dating C, C is cousin of A, D is old schoolmate of B" etc, how can I easily make a chart of everyone's connections to each other? This should preferably be software, as trying to map it out manually is way too timeconsuming and difficult.